attack.t1567.002

APT40 Dropbox Tool User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.exfiltration attack.t1567.002 ·

Share on:

Detects suspicious user agent string of APT40 Dropbox tool

DNS Query for Anonfiles.com Domain - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

DNS Query for Anonfiles.com Domain - Sysmon

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

DNS Query To MEGA Hosting Website

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for subdomains related to MEGA sharing website

DNS Query To MEGA Hosting Website - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for subdomains related to MEGA sharing website

DNS Query To Ufile.io

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

DNS Query To Ufile.io - DNS Client

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

PUA - Rclone Execution

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Rclone Activity via Proxy

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Rclone Config File Creation

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects Rclone config files being created

Data Exfiltration via AWS CLI

Apr 29, 2024 · attack.exfiltration attack.t1567.002 dist.public ·

Share on:

Detects usage of AWS CLI to exfiltrate data

DNS Query for Ufile.io Upload Domain

Feb 23, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detects DNS queries for subdomains used for upload to ufile.io

Rclone SMB Share Exfiltration

Feb 23, 2024 · attack.exfiltration attack.t1567.002 ·

Share on:

Detection of a exfiltration activity using rclone from Windows network shares using SMB.